FAILED: patch "[PATCH] staging: rtl8723bs: fix heap buffer overflow in" failed to apply to 5.10-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 5a752a616e756844388a1a45404db9fc29fec655
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026071336-divorcee-scope-a8b1@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5a752a616e756844388a1a45404db9fc29fec655 Mon Sep 17 00:00:00 2001
From: Alexandru Hossu <[email protected]>
Date: Fri, 22 May 2026 02:45:27 +0200
Subject: [PATCH] staging: rtl8723bs: fix heap buffer overflow in
rtw_cfg80211_set_wpa_ie()
supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc stable <[email protected]>
Reviewed-by Luka Gejak <[email protected]>
Signed-off-by Alexandru Hossu <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +8 -0
@@ -1446,6 +1446,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa =rtw_get_wpa_ie (buf, &wpa_ielen, ielen);if (pwpa && wpa_ielen >0 ) { +if (wpa_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa_ie (pwpa, wpa_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
@@ -1455,6 +1459,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa2 =rtw_get_wpa2_ie (buf, &wpa2_ielen, ielen);if (pwpa2 && wpa2_ielen >0 ) { +if (wpa2_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
Sasha Levin
maintainerPATCH 1/2 staging: rtl8723bs: Fix space issues
From: Franziska Naepelt <[email protected]>
[ Upstream commit c4b811b9361b0d7ea167a79587f5ec0a13fd8863 ]
Fix the following checkpatch space issues:
- CHECK: spaces preferred around that '*' (ctx:VxV)
- CHECK: spaces preferred around that '+' (ctx:VxV)
- CHECK: spaces preferred around that '-' (ctx:VxV)
- CHECK: spaces preferred around that '|' (ctx:VxV)
- CHECK: No space is necessary after a cast
- WARNING: please, no spaces at the start of a line
Signed-off-by Franziska Naepelt <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
Stable-dep-of: 5a752a616e75 ("staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()")
Signed-off-by Sasha Levin <[email protected]>
--- .../staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 84 +++++++++---------- 1 file changed, 40 insertions(+), 44 deletions(-)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +40 -44
@@ -99,14 +99,14 @@ static struct ieee80211_channel rtw_2ghz_channels[] = {static void rtw_2g_channels_init (struct ieee80211_channel *channels) {memcpy ((void *)channels, (void *)rtw_2ghz_channels, -sizeof (struct ieee80211_channel )*RTW_2G_CHANNELS_NUM +sizeof (struct ieee80211_channel ) *RTW_2G_CHANNELS_NUM ); }static void rtw_2g_rates_init (struct ieee80211_rate *rates) {memcpy (rates, rtw_g_rates, -sizeof (struct ieee80211_rate )*RTW_G_RATES_NUM +sizeof (struct ieee80211_rate ) *RTW_G_RATES_NUM ); }
@@ -133,8 +133,8 @@ static struct ieee80211_supported_band *rtw_spt_band_alloc(if (!spt_band) goto exit; - spt_band->channels = (struct ieee80211_channel *)(((u8 *)spt_band)+sizeof (struct ieee80211_supported_band )); - spt_band->bitrates = (struct ieee80211_rate *)(((u8 *)spt_band->channels)+sizeof (struct ieee80211_channel )*n_channels); + spt_band->channels = (struct ieee80211_channel *)(((u8 *)spt_band) +sizeof (struct ieee80211_supported_band )); + spt_band->bitrates = (struct ieee80211_rate *)(((u8 *)spt_band->channels) +sizeof (struct ieee80211_channel ) * n_channels); spt_band->band = band; spt_band->n_channels = n_channels; spt_band->n_bitrates = n_bitrates;
@@ -268,10 +268,10 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wlu32 wpsielen =0 ;u8 *wpsie =NULL ; - wpsie =rtw_get_wps_ie (pnetwork->network.IEs+_FIXED_IE_LENGTH_, pnetwork->network.IELength-_FIXED_IE_LENGTH_,NULL , &wpsielen); + wpsie =rtw_get_wps_ie (pnetwork->network.IEs + _FIXED_IE_LENGTH_, pnetwork->network.IELength - _FIXED_IE_LENGTH_,NULL , &wpsielen);if (wpsie && wpsielen >0 ) - psr =rtw_get_wps_attr_content (wpsie, wpsielen,WPS_ATTR_SELECTED_REGISTRAR , (u8 *)(&sr),NULL ); + psr =rtw_get_wps_attr_content (wpsie, wpsielen,WPS_ATTR_SELECTED_REGISTRAR , (u8 *)(&sr),NULL );if (sr !=0 ) {
@@ -307,9 +307,9 @@ struct cfg80211_bss *rtw_cfg80211_inform_bss(struct adapter *padapter, struct wl/* We've set wiphy's signal_type as CFG80211_SIGNAL_TYPE_MBM: signal strength in mBm (100*dBm) */ if (check_fwstate (pmlmepriv, _FW_LINKED) == true &&is_same_network (&pmlmepriv->cur_network.network, &pnetwork->network,0 )) { - notify_signal =100 *translate_percentage_to_dbm (padapter->recvpriv.signal_strength);/* dbm */ + notify_signal =100 *translate_percentage_to_dbm (padapter->recvpriv.signal_strength);/* dbm */ }else { - notify_signal =100 *translate_percentage_to_dbm (pnetwork->network.PhyInfo.SignalStrength);/* dbm */ + notify_signal =100 *translate_percentage_to_dbm (pnetwork->network.PhyInfo.SignalStrength);/* dbm */ } buf =kzalloc (MAX_BSSINFO_LEN ,GFP_ATOMIC );
@@ -508,22 +508,22 @@ void rtw_cfg80211_indicate_connect(struct adapter *padapter) roam_info.channel = notify_channel; roam_info.bssid = cur_network->network.MacAddress; roam_info.req_ie = - pmlmepriv->assoc_req+sizeof (struct ieee80211_hdr_3addr )+2 ; + pmlmepriv->assoc_req +sizeof (struct ieee80211_hdr_3addr ) +2 ; roam_info.req_ie_len = - pmlmepriv->assoc_req_len-sizeof (struct ieee80211_hdr_3addr )-2 ; + pmlmepriv->assoc_req_len -sizeof (struct ieee80211_hdr_3addr ) -2 ; roam_info.resp_ie = - pmlmepriv->assoc_rsp+sizeof (struct ieee80211_hdr_3addr )+6 ; + pmlmepriv->assoc_rsp +sizeof (struct ieee80211_hdr_3addr ) +6 ; roam_info.resp_ie_len = - pmlmepriv->assoc_rsp_len-sizeof (struct ieee80211_hdr_3addr )-6 ; + pmlmepriv->assoc_rsp_len -sizeof (struct ieee80211_hdr_3addr ) -6 ;cfg80211_roamed (padapter->pnetdev, &roam_info,GFP_ATOMIC ); }else {cfg80211_connect_result (padapter->pnetdev, cur_network->network.MacAddress - , pmlmepriv->assoc_req+sizeof (struct ieee80211_hdr_3addr )+2 - , pmlmepriv->assoc_req_len-sizeof (struct ieee80211_hdr_3addr )-2 - , pmlmepriv->assoc_rsp+sizeof (struct ieee80211_hdr_3addr )+6 - , pmlmepriv->assoc_rsp_len-sizeof (struct ieee80211_hdr_3addr )-6 + , pmlmepriv->assoc_req +sizeof (struct ieee80211_hdr_3addr ) +2 + , pmlmepriv->assoc_req_len -sizeof (struct ieee80211_hdr_3addr ) -2 + , pmlmepriv->assoc_rsp +sizeof (struct ieee80211_hdr_3addr ) +6 + , pmlmepriv->assoc_rsp_len -sizeof (struct ieee80211_hdr_3addr ) -6 ,WLAN_STATUS_SUCCESS ,GFP_ATOMIC ); } }
@@ -856,7 +856,7 @@ static int rtw_cfg80211_set_encryption(struct net_device *dev, struct ieee_param param->u.crypt.err =0 ; param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN -1 ] ='\0' ; -if (param_len < (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len) +if (param_len < (u32)((u8 *)param->u.crypt.key - (u8 *)param) + param->u.crypt.key_len) { ret = -EINVAL ; goto exit;
@@ -1253,10 +1253,10 @@ static int cfg80211_rtw_get_station(struct wiphy *wiphy, }/* for Ad-Hoc/AP mode */ -if ((check_fwstate (pmlmepriv,WIFI_ADHOC_STATE ) - ||check_fwstate (pmlmepriv,WIFI_ADHOC_MASTER_STATE ) - ||check_fwstate (pmlmepriv,WIFI_AP_STATE )) - &&check_fwstate (pmlmepriv, _FW_LINKED) +if ((check_fwstate (pmlmepriv,WIFI_ADHOC_STATE ) || +check_fwstate (pmlmepriv,WIFI_ADHOC_MASTER_STATE ) || +check_fwstate (pmlmepriv,WIFI_AP_STATE )) && +check_fwstate (pmlmepriv, _FW_LINKED) ) {/* TODO: should acquire station info... */
@@ -1520,7 +1520,7 @@ static int cfg80211_rtw_scan(struct wiphy *wiphyDBG_871X ("%s under WIFI_AP_STATE\n" , __func__);#endif -if (check_fwstate (pmlmepriv,WIFI_UNDER_WPS |_FW_UNDER_SURVEY|_FW_UNDER_LINKING) == true) +if (check_fwstate (pmlmepriv,WIFI_UNDER_WPS | _FW_UNDER_SURVEY | _FW_UNDER_LINKING) == true) {DBG_8192C ("%s, fwstate = 0x%x\n" , __func__, pmlmepriv->fw_state);
@@ -1593,7 +1593,7 @@ static int cfg80211_rtw_scan(struct wiphy *wiphy }/* parsing channels, n_channels */ -memset (ch,0 ,sizeof (struct rtw_ieee80211_channel )*RTW_CHANNEL_SCAN_AMOUNT ); +memset (ch,0 ,sizeof (struct rtw_ieee80211_channel ) *RTW_CHANNEL_SCAN_AMOUNT );for (i =0 ; i < request->n_channels && i <RTW_CHANNEL_SCAN_AMOUNT ; i++) {#ifdef DEBUG_CFG80211 DBG_871X(FUNC_ADPT_FMT CHAN_FMT"\n", FUNC_ADPT_ARG(padapter), CHAN_ARG(request->channels[i]));
@@ -1611,7 +1611,7 @@ static int cfg80211_rtw_scan(struct wiphy *wiphyfor (j = request->n_channels -1 ; j >=0 ; j--)for (i =0 ; i < survey_times; i++) { -memcpy (&ch[j*survey_times+i], &ch[j],sizeof (struct rtw_ieee80211_channel )); +memcpy (&ch[j * survey_times + i], &ch[j],sizeof (struct rtw_ieee80211_channel )); } _status =rtw_sitesurvey_cmd (padapter, ssid,RTW_SSID_SCAN_AMOUNT , ch, survey_times * request->n_channels); }else {
@@ -1791,7 +1791,7 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel goto exit; } -if (ielen >MAX_WPA_IE_LEN +MAX_WPS_IE_LEN +MAX_P2P_IE_LEN ) { +if (ielen >MAX_WPA_IE_LEN +MAX_WPS_IE_LEN +MAX_P2P_IE_LEN ) { ret = -EINVAL ; goto exit; }
@@ -1819,26 +1819,22 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel } pwpa =rtw_get_wpa_ie (buf, &wpa_ielen, ielen); -if (pwpa && wpa_ielen >0 ) - { -if (rtw_parse_wpa_ie (pwpa, wpa_ielen+2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) - { +if (pwpa && wpa_ielen >0 ) { +if (rtw_parse_wpa_ie (pwpa, wpa_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK; -memcpy (padapter->securitypriv.supplicant_ie, &pwpa[0 ], wpa_ielen+2 ); +memcpy (padapter->securitypriv.supplicant_ie, &pwpa[0 ], wpa_ielen +2 );DBG_8192C ("got wpa_ie, wpa_ielen:%u\n" , wpa_ielen); } } pwpa2 =rtw_get_wpa2_ie (buf, &wpa2_ielen, ielen); -if (pwpa2 && wpa2_ielen >0 ) - { -if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen+2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) - { +if (pwpa2 && wpa2_ielen >0 ) { +if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK; -memcpy (padapter->securitypriv.supplicant_ie, &pwpa2[0 ], wpa2_ielen+2 ); +memcpy (padapter->securitypriv.supplicant_ie, &pwpa2[0 ], wpa2_ielen +2 );DBG_8192C ("got wpa2_ie, wpa2_ielen:%u\n" , wpa2_ielen); }
@@ -2305,7 +2301,7 @@ static int cfg80211_rtw_set_pmksa(struct wiphy *wiphy,memcpy (psecuritypriv->PMKIDList[index].PMKID, (u8 *)pmksa->pmkid,WLAN_PMKID_LEN ); psecuritypriv->PMKIDList[index].bUsed = true; - psecuritypriv->PMKIDIndex = index+1 ; + psecuritypriv->PMKIDIndex = index +1 ; blInserted = true;break ; }
@@ -2479,8 +2475,8 @@ static netdev_tx_t rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, strucreturn _rtw_xmit_entry (skb, padapter->pnetdev); } -else if ((frame_control & (IEEE80211_FCTL_FTYPE |IEEE80211_FCTL_STYPE )) - == (IEEE80211_FTYPE_MGMT |IEEE80211_STYPE_ACTION ) +else if ((frame_control & (IEEE80211_FCTL_FTYPE |IEEE80211_FCTL_STYPE )) + == (IEEE80211_FTYPE_MGMT |IEEE80211_STYPE_ACTION ) ) {/* only for action frames */
@@ -2618,7 +2614,7 @@ static int rtw_cfg80211_add_monitor_if(struct adapter *padapter, char *name, str } *ndev = pwdev_priv->pmon_ndev = mon_ndev; -memcpy (pwdev_priv->ifname_mon, name,IFNAMSIZ +1 ); +memcpy (pwdev_priv->ifname_mon, name,IFNAMSIZ +1 ); out:if (ret && mon_wdev) {
@@ -2721,14 +2717,14 @@ static int rtw_add_beacon(struct adapter *adapter, const u8 *head, size_t head_lif (head_len <24 )return -EINVAL ; - pbuf =rtw_zmalloc (head_len+tail_len); + pbuf =rtw_zmalloc (head_len + tail_len);if (!pbuf)return -ENOMEM ; -memcpy (pbuf, (void *)head+24 , head_len-24 );/* 24 =beacon header len. */ -memcpy (pbuf+head_len-24 , (void *)tail, tail_len); +memcpy (pbuf, (void *)head +24 , head_len -24 );/* 24 =beacon header len. */ +memcpy (pbuf + head_len -24 , (void *)tail, tail_len); - len = head_len+tail_len-24 ; + len = head_len + tail_len -24 ;/* check wps ie if inclued */ if (rtw_get_wps_ie (pbuf+_FIXED_IE_LENGTH_, len-_FIXED_IE_LENGTH_,NULL , &wps_ielen))
@@ -3084,7 +3080,7 @@ static int cfg80211_rtw_mgmt_tx(struct wiphy *wiphy, pwdev_priv =adapter_wdev_data (padapter);/* cookie generation */ - *cookie = (unsigned long ) buf; + *cookie = (unsigned long )buf;#ifdef DEBUG_CFG80211 DBG_871X(FUNC_ADPT_FMT" len =%zu, ch =%d"
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/2 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
From: Alexandru Hossu <[email protected]>
[ Upstream commit 5a752a616e756844388a1a45404db9fc29fec655 ]
supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer.
Fixes 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc stable <[email protected]>
Reviewed-by Luka Gejak <[email protected]>
Signed-off-by Alexandru Hossu <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
Signed-off-by Sasha Levin <[email protected]>
--- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +8 -0
@@ -1820,6 +1820,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa =rtw_get_wpa_ie (buf, &wpa_ielen, ielen);if (pwpa && wpa_ielen >0 ) { +if (wpa_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa_ie (pwpa, wpa_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
@@ -1831,6 +1835,10 @@ static int rtw_cfg80211_set_wpa_ie(struct adapter *padapter, u8 *pie, size_t iel pwpa2 =rtw_get_wpa2_ie (buf, &wpa2_ielen, ielen);if (pwpa2 && wpa2_ielen >0 ) { +if (wpa2_ielen +2 >sizeof (padapter->securitypriv.supplicant_ie)) { + ret = -EINVAL ; + goto exit; + }if (rtw_parse_wpa2_ie (pwpa2, wpa2_ielen +2 , &group_cipher, &pairwise_cipher,NULL ) == _SUCCESS) { padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X; padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
Signature · 1 line
2.53.0